Pilz pnoz X3 Emergency Stop Relay, Safety Gate Monitor

[Kjelt]

So I am building a CNC machine (different story) and one of the things you actually should do is equip the machine with Emergency stops and a safety relay/controller.
Its purpose is to monitor the safety switches and other signs of trouble and directly stop the moving parts of the machine.
Reading the datasheets they claim during startup to check and monitor all the relays states, detect short circuits in the external wiring and other fancy pancy talk.

Those things are bloody expensive, think around $200 for a simple one upto $600 for a more elaborate one.
Luckily today I got hold of two second hand Pilx Pnoz X3 for a reasonable figure (<$50 the two) so ofcourse I was very curious what kind of sophisticated emergency monitoring hardware was inside this thing. I expected one or two microcontrollers, or an FPGA or something like the sorts.

But there is nothing in there but a few relays and opto's 
I mean literally nothing! Look at the pictures, yeah the relays are Swiss made pretty expensive probably but the electronics ........
Any one here an expert on these things and tell me what I am missing ?

[Bratster]

The liability aspect.

Those are safety components, so it has to be 100%reliable.



Sent from my Nexus 6 using Tapatalk

[wolfp]

Hello kjelt,

I am one of these experts working in the field of Functional Safety.

What you are missing is called "Safety Related Control Function" SRCF and the standards ISO 13849-1:2015, ISO 13849-2:2012.
PNOZ X3 is a device which is able to perform  SRCFs. It detects internal and some external faults and performs the SRCF up to Cat.4, Pl=e ISO 13849-1:2015. That means e.g. that even in the case of an internal fault the safety related control function will be performed.
If you want to know what the SRCF of PNOZ X3 is - have a look into the user manual.

If PNOZ X3 is too expensive: build your own safety relay using two (or three) relays with forcibly guided contacts.

 

[Kjelt]

Ah great an expert 
I now have a few of these X3s and just experimented with them since the manual was not clear to me as safety newbie 
What I found out is that the X3 has three inputs and I think this is how it should work:

S11-S12  Ch1+2  E-stop switches                    Error is resettable

S21-S22  Ch1    Hardlimit of hard error switches   Error is not resettable

S31-S32  Ch2    Hardlimit of hard error switches   Error is Not resettable

Automatic reset when short between S13-S14.
S11-12 will restart automatically when closed again but others not.

Manual reset
S13-S14 normally open switch, press for manual reset only S11-12 Again closed.

So is this how it should work an e-stop switch in s11-12 which can be reset but the other inputs for catastrophic failures and need to repower the entire device?
Thanks.

How about a 24000 rpm spindle motor, if I kill the mains to the vfd it will continue to turn till it stops in a few minutes, if I use an input to the vfd it will stop in 10 seconds but the power will remain present. Any ideas on that?

[wolfp]

The problem you have concerning the drive is quite usual. The solution may be to do a "Stop Cat.1" according to EN 60201-1:2006 clause 9.2.2. That means you inform the drive control to stop immediately but you switch off the power supply of the drive control with a delay. So the drive control has the chance to stop the motor, then it is switched off (Stop Cat.0).
Is the residual risk (moving motor after power off) not acceptable, you can use interlock-devices with motion monitoring devices. The door can only be opened after the movement of the drive has stopped.

Be careful what you are doing, I propose to first have a look into the Machinery Directive and its Guide (if you are in Europe).

[Kjelt]

The problem you have concerning the drive is quite usual. The solution may be to do a "Stop Cat.1" according to EN 60201-1:2006 clause 9.2.2. That means you inform the drive control to stop immediately but you switch off the power supply of the drive control with a delay. So the drive control has the chance to stop the motor, then it is switched off (Stop Cat.0).

Thanks, makes sense.
Are there any Pilzor other safety devices that have this functionality built in or do you need an extra external time delay relais for that?

[NiHaoMike]

You could have a relay switch the motor to a resistor bank (BLDC) or DC braking capacitor (induction) if it is deenergized.

That said, if it's only for your own (hobby) uses, I'd be surprised if AvE's or Aussie50's home CNC setup would be able to pass a formal safety inspection, but it would still be interesting to find out what safety devices they do use.

[radar_macgyver]

Phoenix Contact's PSR-SCP-24DC/ESD/4X1/30 (cat #2981800) will do time-delay on two contacts, and immediate operation on the other two. It was the recommended part for a servo drive that I used. The immediate contact issues a drive disable command, and the time delay contacts open the gate drive to the IGBTs. Since the servos are BLDCs, they will stop immediately.

The equivalent Pilz relay is the PNOZ s5.

[tomduly]

The Pilz company has a remarkable safety product philosophy. One of their R&D managers once told me, that each product development engineer is repeatedly reminded a mind game: "Imagine, you are the maintenance technician that has to crawl into the load opening of a huge hydraulic press like used in the automotive sector - would you really trust your electronic shutdown device, that prevents the press from operation during your maintenance job inside the press?"

Highly automated 24/7 production lines (automotive and so on), cannot be easily shut down for parts replacement or maintenance. So the maintenace crew has to work under conditions with running machines surrounding them, just protected by safety electronics but not really shut down and locked.
 
For special safety products, Pilz also has several hard&software teams in parallel on the same device design project. The teams have to use different software tools like compilers and they have to implement the required safety functions on different MCUs from different manufacturers. At the end, the resuts of these teams are put together into a final device, containing several signal paths from input to output in parallel, each path with its own firmware and MCU type, and some kind of majority voting over these signal channels is done.
Another speciality of Pilz are emergency stop switches that trigger high current contactors (relays). To make sure, a normally never used emergency contactor will not fail due to sticking mechanical parts after years of permanent "on-only" operation, the safety circuit from time to time turns off the contactor for a few milliseconds, just to detect the starting movement of the solenoid armature and then turns it on again - without "really" breaking the shutdown circuit.

There are decades of safety know-how behind such products for functional safety. And they have all the safety approvals, needed for technical applications that are hazardous or life threatening. That makes the price, even for low-tech components.

Tom